This vulnerability is a cross‑site request forgery (CSRF) flaw that allows an attacker to trick an authenticated user of the SABBATIC application into sending unauthorized requests to vulnerable endpoints. The consequence is that unintended operations can be performed within the application, potentially modifying or exposing data controlled by the account holder. The weakness is classified as CWE-352.

The SABBATIC application is affected, specifically all versions released prior to 7.96.0.1 and 7.96.0.2. Users running these older releases are vulnerable.

The CVSS score of 4.8 indicates moderate risk, and the EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a crafted URL or malicious web page that the user must visit while authenticated, which triggers state‑changing requests without proper CSRF protection. The issue is mitigated by applying the patch to version 7.96.0.1 or later, which disables the affected vulnerable endpoints.